CVE-2025-59703

An attacker with physical access to the device can remove the security label (tamper label) and all mounting screws without damaging them, thereby gaining access to the interior of the HSM module. This technique, referred to as an F14 attack, allows for hardware tampering in a way that leaves no detectable traces of breach. As a result, the physical tampering detection mechanisms (tamper evidence) provided in the device design become ineffective.

The attacker gains physical access to internal components of the HSM module, which may enable theft of cryptographic keys, hardware modification, or injection of malicious components, while leaving no visible traces of device integrity breach.

Patches available from the manufacturer should be applied in accordance with the references. It is also recommended to implement additional physical access control measures for HSM devices, conduct regular inspections of security labels, and monitor the physical environment in which HSM modules operate.

Entrust nShield Connect XC, nShield 5c, and nShield HSMi in versions up to and including 13.6.11 or 13.7